Extracted

• • Target

    6de0f794e0798e016ae648c0d14e8b8d

  • Size

    2.3MB

  • MD5

    6de0f794e0798e016ae648c0d14e8b8d

  • SHA1

    5d7b08a3a4bcf39e7b8f4df472bb76843261dd54

  • SHA256

    1440b2cef20cfbb1fa92a14e41967dd1e9feb8ae21e9523a72a79ac95efd9017

  • SHA512

    c9757ce91ebfd09afdae5928836686bcd0cff556a63fd5cdb3b7e0cab6df7b429aa9cbd678a2152aecf0902e202f429e8d0ddbc01d0b2a835291e50204a5890c

  • SSDEEP

    49152:7PFWW0ErxmK/UGHpULRF9lvglr1IswCgfx9ktrqbGq9sMZidOD42I6M:bFWWPmKstb9lvDsHvq5sM8MI6

  Score

  10^/10

  bitratpersistencetrojanupx

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

    trojanbitrat

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2